Types of Account Thefts

The first question on the minds of most account theft victims is, “How did this happen?” It’s a good question, and answering it is the first step in regaining control of your account and plugging any security holes that may exist.

Should your account have been compromised, the following list of types of account theft should help shed some light on how your account was stolen and what steps you can take to prevent any further damage.

Sharing Account Info

The simplest form of account theft occurs when a user willingly shares login information with another player. This person may be someone you know and trust in real-life, or someone using a tactic called “social engineering” to get your information.

Sharing your account info is simply a bad idea.

Solution:

Avoiding this kind of theft is easy: just don’t share your info. If you did share your information with someone else and you now suspect that your account has been stolen, change your password immediately to avoid any further damage. Also, do not log on from someone else’s computer. Even if you practice perfect Internet security at home, you’ll waste all that effort if you log on from a friend’s machine that has been compromised.

Phishing Emails

The practice of “phishing” is the most common strategy used by account thieves. Many cases of people claiming they were “hacked” can actually be traced back to phishing schemes. These emails and websites pretend to be official Blizzard Entertainment communications to trick you into willingly handing out your login information. Here are some signs that you may be dealing with a phishing attempt:

Phishing emails will ask you for password or login information. Blizzard Entertainment emails will never ask for your password.

Phishing emails will make urgent appeals in regards to your account being under investigation for hacking/cheating and ask that you provide personal information to avoid these penalties.

Phishing emails and websites may also make offers that seem too good to be true, such as early entry into Blizzard Entertainment beta tests, special promotions, etc.

Phishing emails frequently contain grammatical and/or spelling mistakes. If you can spot obvious typos and grammatical/syntactical errors, you are likely dealing with a phishing email.

Some phishing emails will mask, or “spoof” their sending address, making it appear as though the emails are being sent from Blizzard Entertainment. Check the email’s header information to verify the sending address.

Be aware of in-game mails or whispers that impersonate Blizzard or Blizzard employees.

Solution:

The best way to avoid becoming a victim of a phishing attempt is to exercise caution when receiving any kind of information purporting to come from Blizzard. If an email asks for your password, makes urgent appeals, sounds too good to be true, or links to “account management” sites outside of Blizzard’s sites (you can find a list of all official Blizzard domains here), you are dealing with a phishing attempt. Add the sender to your “blocked senders” list, forward the email to hacks@blizzard.com, then delete the email. If you believe you have recently fallen victim to a phishing attempt, change your password immediately.

We will never ask for your password in an email.

Find out how to spot phishing emails by looking at these examples:

From: "WoWAccountAdmin" <WoWAccountReview@blizzardadmins.net1>

Greetings,

It has come to our attention that you are trying to sell or trade your personal World of Warcraft account. As you may or may not be aware of2, these actions conflict with the EULA and Terms of Service (TOS) of Blizzard Entertainment and World of Warcraft. If upon further investigation you are indeed attempting to obtain monetary profit against the TOS agreement3, your account can and will be disabled. Blizzard has the right to consider legal action if necessary, based on the severity of the action.

If you hope to avoid account suspension4 you should verify your personal possession of the account in question. We at Blizzard Entertainment take infractions of the TOS quite seriously and we must confirm the original ownership of the account. This is easily done by supplying your account information below.

Please use the following template below to verify your account and information via email.

- Account Email:- Account Password:5

If you ignore this communication your account can and will be closed permanently due to suspicions of alternative ownership. We ask that during the investigation you give approximately twenty-four hours of inactivity after sending a response email. This should provide enough time for Blizzard to confirm your identity and that the TOS are being followed as outlined.

Official Blizzard support emails will ONLY come from @Blizzard.com or @Battle.net. Also keep in mind that email addresses can be disguised as official ones. Check the email header to see where the email really came from.

1

Official Blizzard mails will never feature such a blatant lack of style.

2

Again, watch for bad grammar and style as indicators of fake emails.

3

Note the stilted wording. The blind grasping for words. The horror. The horror.

4

Blizzard emails will NEVER ask you for your password. Never ever ever. EVER.

5

Greetings,

An investigation of your World of Warcraft account has found strong evidence that you are eligible for an account upgrade. You are eligible for the Wrath of the Lich King Beta. To sign-up and get your download please visit our website at this special link1: http://worldofwarcraft.com/login This process usually last’s2 one week. Thank you for your time and attention to this matter, and your continued interest in World of Warcraft.

Sincerely,

Account AdministrationBlizzard Entertainment

Appearances can be deceiving. Even though the URL looks harmless, it could actually redirect to a phishing website (which is often indistinguishable from the real thing, in this case, a copy of worldofwarcraft.com). Even hovering over the link may not betray its true destination. It bears repeating: as a general rule, don’t click on links in emails.

1

Mistakes such as this easily betray a phishing email’s true colors. (In this case, mauve.)

2

In attention of our World Of Warcraft customer,

Our automated security systems have indicated that access to your online account was temporarily blocked due to to repeated login failures. Our logs indicate that your account received 20 authentication failures during this time. It is most probable that your account was subject to malicious attack through automated brute forcing techniques. While World Of Warcraft were able to successfully block this attack, we would recommend that you ensure that your password is sufficiently complex to prevent future attacks. You must click the link below1 and enter your password on the following page to confirm the reactivation of your account.

- Verify that your contact information is accurate and update it if necessary.- Create a new, not-easily guessed, secure personal password; an example of this may include letters and numbers.- Please be sure to scan the computer system you are using to remove all viruses, Trojan files, and key loggers.- Maintain safe Internet practices and safeguard all World of Warcraft account information for the most secure gaming experience.

Don’t EVER click on the link below. Okay, nobody’s perfect, we’ve all accidentally clicked on a link. But if you do click on a link like this one, please CLOSE THE BROWSER immediately and DON’T give them your login information.

1

Appearances can be deceiving. Even though the URL looks harmless, it could actually redirect to a phishing website (which is often indistinguishable from the real thing, in this case, a copy of worldofwarcraft.com). Even hovering over the link may not betray its true destination. It bears repeating: as a general rule, don’t click on links in emails.

In-game Phishing

"Phishing" attempts can also occur in-game. These attempts often come from people pretending to be Blizzard employees through a whisper ("tell") or in-game mail. Scammers posing as Blizzard employees might inform you of a "problem" with your account or try to direct you to a unique opportunity. Though they may ask for your account information directly, these thieves are just as likely to request that you visit an external website to hand over your account information.

How to recognize and avoid phishing attempts:

In-game Mail

If you receive any kind of communication that claims to be from Blizzard Entertainment, review it carefully. Legitimate whispers and in-game mail from Blizzard staff are accompanied by the blue Blizzard logo. Click the button below to compare an example of phishing mail to a legitmate Blizzard in-game mail.

In-game Chat

When you receive a whisper from a Blizzard representative, you’ll also see a box appear in the upper-right hand corner of your screen indicating that a Blizzard employee wants to chat with you. The box also contains the Blizzard logo. CLick the button below to compare in-game chat with a Blizzard GM to a conversation with a scammer impersonating a Blizzard employee.

Phishing In-Game Mail

Blizzard In-Game Mail

1
This in-game mail doesn’t include the blue Blizzard logo, a sure sign that it’s fake.

2
Pay close attention to the grammar in this correspondence. Improper usage ("you are drawn in the system") is a clear sign that the message you’re receiving could be a scam.

3
There’s a lot of information missing from this vague correspondence, like the specific achievement or mount being referenced. Pertinent details are always included in official messages from Blizzard employees.

4
The link included here, webworldofwarcraft.com isn’t an official Blizzard site - another tell-tale sign of illegitimacy.

If you don’t see the blue Blizzard logo and the Blizzard chat pop-up window (as detailed above) it’s possible that the player speaking with you is a scammer.

You can also identify an imposter by looking at the instructions they provide you, particularly any website URLs they might ask you to visit. Blizzard staff will NOT direct you to any websites other than our official domains for concerns, questions or information about your account.

If you feel you’ve been contacted by a scammer, please submit a GM report using the "report spam" button.

Gold Sellers and Leveling Services

Gold sellers and leveling services are responsible for the vast majority of all account thefts, and they are the number-one source of World of Warcraft-related phishing attempts, spyware, and even credit card theft. Players who buy gold actively support spam, hacks, and keyloggers, and by doing so diminish the gameplay experience for everyone else.

If you buy gold, you support a major source of spam, hacks, and keyloggers.

Solution:

Do not buy gold, and do not solicit power levelers. Frankly, their services are not worth the money or the headache of potential credit card theft, not to mention a permanent ban if you are caught. Factor in the fact that supporting them means making the game worse for everyone, and it becomes clear that what they are offering simply isn’t worth it. Read more about the adverse effects of buying gold here.

Malicious Add-ons

Some hackers try to turn our community’s very creativity against them by injecting computer viruses and other malware (including keyloggers) into otherwise legitimate player-made add-ons. At the very least, this can break your game installation; at the worst, it can lead to irreparable damage to your computer, financial consequences due to credit card theft, or even real-life identity theft.

Use caution when you download and install add-ons.

Solution:

Be extremely careful when downloading and installing game add-ons. If an add-on asks that you download an executable file, cancel the download immediately. If you believe you have recently fallen victim to a malicious add-on, immediately have your anti-virus software run a full system scan, then change your password.

Malicious Websites

Malicious websites target your browser’s weak spots by attempting to install harmful software on your computer, with end results similar to malicious add-ons. These sites may be obvious, or they may be designed to look exactly like a Blizzard website. One easy way to tell is by looking closely at the site’s URL. If it’s not a Blizzard URL but the site claims to be official, you are probably dealing with a malicious website. You can find a list of all official Blizzard domains here.

Always keep your browser and anti-virus software up-to-date.

Solution:

The most important thing to avoid becoming a victim of a malicious website is to make sure your browser and anti-virus software are up-to-date. Carefully examine any and all links you are presented with, even from close friends. If you believe you have recently fallen victim to a malicious website, immediately have your anti-virus software run a full system scan, then change your password.

Duplicate Usernames and Passwords

If you use your Battle.net account’s email address or password to create an account for another game or website, you’ve put the security of your Battle.net account at risk. If someone was to gain access to your login information on the other game or website, they’ve got your Battle.net login information as well. In addition, someone deliberately targeting Battle.net accounts could create a site for that purpose, such as a fansite or forum for a Blizzard game. If you register on that website with your Battle.net username and password, you’ve given that person the keys to your account.

Don’t use your Battle.net password on other websites.

Solution:

Use an alternate email when registering for other services, such as an account you create for that specific purpose. Should that email account or any of the sites you used it for become compromised, your Battle.net account is still safe. And at the very least, use a different password for each account that shares the same email address.